Most phishing and scam attempts follow predictable patterns. A few consistent habits are usually all it takes to catch them before they cause a problem.

The most common way scams work is through a link or attachment in an unexpected message. It might be an email, a text, or a social media message that looks like it's coming from somewhere legitimate. A fake invoice from a supplier. A message claiming your bank account needs attention. A deal on equipment that seems too good to pass up.

Before clicking anything unexpected, take a second to look closer. Does the sender's email address actually match the organization it's claiming to be from? Were you expecting this message? When in doubt, go directly to the organization's website by typing the address into your browser yourself rather than following a link.

Urgency is one of the most common tools scammers use. Messages that say your account will be suspended, that you need to act within 24 hours, or that you're about to miss out on something are designed to get you moving before you've had a chance to think. Legitimate organizations like your bank, your lender, or a government agency generally give you reasonable time to respond and won't pressure you to act immediately.

If a message is pushing hard for a fast response, that's a good reason to slow down, not speed up.

If a message or request doesn't quite sit right but you're not sure why, ask someone else to take a look. A family member, an employee, or anyone else who's comfortable with technology can be helpful here. Describing a suspicious message out loud often surfaces the problem quickly.

The groups you work with regularly have standard ways of communicating with you. Your bank doesn't call out of the blue asking you to confirm your account number. The USDA won't ask you to pay an upfront fee over the phone to access a program. Your equipment dealer's service team will have a process for scheduling visits that you'd recognize.

When you know the normal routine, it's easier to spot when something is off. No legitimate company will ever ask you to share your password or read back a Multi-Factor Authentication (MFA) code over the phone or in a message. If someone asks for either of those, treat it as a warning sign regardless of how official the message looks.

• Have I Been Pwned (check if your email has appeared in a known data breach): https://haveibeenpwned.com
• Pause. Take 9. https://pausetake9.org/
• CISA – Recognize and Report Phishing: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
• Report Fraud to the FTC: https://reportfraud.ftc.gov